Enhanced Security Operations Managed Service

The Student Loans company (SLC) have an agreement for Enhanced Security Operations Managed Service expiring April 2028. In order to provision for a retender of the agreement SLC are undertaking pre-market engagement with regards to the provision of the following:

• Requirement A: Enhanced Security Operations Managed Service - MXDR Service (2026-TR-0109a)

• Requirement B: Enhanced Security Operations Managed Service - Vulnerability Management (VM) Service (2026-TR-0109b)

• Requirement C: Enhanced Security Operations Managed Service - Breach Attack Simulation (BAS) Service (2026-TR-0109c)

• Requirement D: Enhanced Security Operations Managed Service - Cyber Threat Intelligence (CTI) Service (2026-TR-0109d)

• Requirement E: Enhanced Security Operations Managed Service - Digital Forensics and Incident Response (DFIR) Retainer Service (2026-TR-0109e)

• Requirement F: Enhanced Security Operations Managed Service - Security Architecture and Engineering Support Services (2026-TR-0109f)

SLC is considering an approach to the market to give the suppliers an option to bid for one or ALL of the contractual requirements.

Requirement A

Enhanced Security Operations Managed Service - MXDR Service

The Supplier will provide a Managed Extended Detection and Response (MXDR) capability operating on a hybrid customer/supplier model.

MXDR Service

The Supplier will provide:

• 24x7x365 monitoring of SLC security telemetry.

• L1 and L2 Security Operations Centre capability (SLC retain L3).

• Incident identification, triage and investigation.

• Security use-case monitoring and tuning.

• Management of Microsoft Sentinel detections.

• SOAR playbook execution and optimisation.

• Escalation management.

• Alert enrichment.

• Threat hunting capability.

• Malicious activity investigation.

• Service governance and performance management.

• Security reporting at operational, tactical and strategic levels.

Security Engineering (Operational)

The Supplier shall provide:

• L3 Engineering support for Sentinel.

• Analytics rule development and tuning.

• SOAR playbook management.

• Connector maintenance and health monitoring.

• Logging optimisation.

• Onboarding and validation of agreed log sources.

• Detection engineering support.

• Detection gap analysis and monitoring coverage reviews.

• Security use case development and continuous improvement.

• Monitoring health checks.

• Monitoring and remediation of ingestion issues.

• Security platform optimisation.

• Proactive automation support and development.

• Threat intelligence-led detection improvements.

Data Loss Prevention (DLP) & Phishing

The Supplier shall:

• Monitoring, triage and investigation of DLP, phishing, business email compromise (BEC), malicious email, malicious attachment and malicious URL alerts.

• Investigation of suspected data loss, data exfiltration and policy breach events.

• Support for user reported phishing submissions.

• Escalation and coordination of confirmed incidents in accordance with agreed response procedures.

• Identification and analysis of phishing campaigns, attacker infrastructure, indicators of compromise and emerging attack trends.

• Recommendations for improvements to DLP policies, email security controls, detections and response processes.

• Monthly reporting, trend analysis and security improvement recommendations.

Reporting

The Supplier shall provide:

• Weekly operational reports.

• Monthly service reports.

• Quarterly service reviews.

• KPI and SLA reporting.

• Security metrics and trend analysis.

Requirement B

Enhanced Security Operations Managed Service - Vulnerability Management Service

The Supplier shall provide Vulnerability Management services Monday to Friday, UK Core Hours (09:00-17:00).

Vulnerability Management

The Supplier shall:

• Monitor vulnerability management queues.

• Investigate vulnerability notifications.

• Manage vulnerability triage.

• Validate vulnerability findings.

• Perform exploitability assessments.

• Provide remediation recommendations.

• Support exposure management activities.

• Support CTEM activities.

Stakeholder Engagement

The Supplier shall:

• Conduct monthly technical review meetings.

• Support resolver teams.

• Assist remediation planning.

• Review remediation performance.

• Provide vulnerability prioritisation guidance.

Dashboarding & Reporting

The Supplier shall:

• Maintain executive dashboards.

• Enhance Power BI reporting.

• Produce technical reports.

• Produce executive reports.

• Produce PCI compliance reports.

• Produce risk trending reports.

Tooling

The Supplier shall support:

• Microsoft Defender for Endpoint.

• Rapid7.

• SLC PCI ASV Scanning tooling.

• Jira.

• Power BI.

Requirement C

Enhanced Security Operations Managed Service - Breach Attack Simulation Service

The Supplier shall provide a Breach Attack Simulation (BAS) capability, currently using AttackIQ or similar.

BAS Service

The Supplier shall:

• Operate and maintain the BAS platform.

• Deploy and maintain BAS agents.

• Configure integrations.

• Execute scheduled simulations.

• Execute customer-specific simulations.

• Execute retests following remediation activities.

Adversary Simulation

Testing scenarios shall include:

• Initial Access.

• Execution.

• Persistence.

• Privilege Escalation.

• Credential Access.

• Lateral Movement.

• Command and Control.

• Exfiltration.

• Malware.

• Ransomware.

• Advanced Persistent Threat activity.

Security Validation

The Supplier shall assess:

• Security control effectiveness.

• Security monitoring effectiveness.

• Detection coverage.

• Response capability.

• Incident handling.

• Use-case effectiveness.

Reporting

The Supplier shall produce:

• Monthly BAS reports.

• Executive summaries.

• Technical findings.

• Remediation recommendations.

• Retest outcomes.

Requirement D

Enhanced Security Operations Managed Service - Cyber Threat Intelligence Service

The Supplier shall provide strategic, operational and tactical Cyber Threat Intelligence services.

Threat Intelligence Managed Service

The Supplier shall provide:

• Threat Intelligence reporting.

• Integration into Microsoft Sentinel.

• Indicator of Compromise feeds.

• Threat actor intelligence.

Operational Intelligence

The Supplier shall provide:

• Threat alerts.

• Vulnerability intelligence.

• Emerging threat notifications.

• Campaign tracking.

• Industry specific intelligence.

Strategic Intelligence

The Supplier shall provide:

• Threat landscape assessments.

• Quarterly threat reports.

• Executive intelligence briefings.

• Board level threat summaries.

• Sector specific threat reporting.

Security Operations Support

The Supplier shall provide:

• Intelligence support during incidents.

• Threat hunting support.

• Intelligence driven use-case creation.

• Intelligence enrichment services.

Requirement E

Enhanced Security Operations Managed Service - Digital Forensics & Incident Response Retainer Service

The Supplier shall provide a DFIR Retainer available 24x7x365.

Cyber Incident Response

The Supplier shall provide:

• Incident investigation.

• Malware analysis.

• Threat containment.

• Threat eradication.

• Recovery support.

• Crisis management support.

• Regulator support.

• On-site support

Digital Forensics

The Supplier shall provide:

• Evidence acquisition.

• Chain of custody management.

• Endpoint forensics.

• Server forensics.

• Network forensics.

• Cloud forensics.

• Forensic reporting.

Readiness Services

The Supplier shall provide access to:

• Tabletop exercises.

• Incident simulations.

• Executive workshops.

• CSIRT training.

• Lessons learned reviews.

Retained Consultancy

The Supplier shall provide specialist support including:

• Security strategy input.

• Audit support.

• Major incident reviews.

• Regulatory engagement support.

• Ransomware negotiation services.

Requirement F

Enhanced Security Operations Managed Service - Security Architecture & Engineering Support Services

The Supplier shall provide specialist Security Architecture and Engineering services on a call-off basis.

Security Architecture

The Supplier shall provide:

• Security architecture reviews.

• Security design authority support.

• Secure by Design reviews.

• Solution security reviews.

• Threat modelling.

• Architecture governance.

• Security requirements definition.

• Architectural risk assessments.

Security Engineering

The Supplier shall provide:

• Technical security engineering.

• Security tool implementation.

• Security configuration reviews.

• Security hardening activities.

• Technical control implementation.

Strategy & Transformation

The Supplier shall provide:

• Security roadmap development.

• Target operating model development.

• Control framework assessments.

• Security maturity reviews.

• Improvement planning.

Governance & Assurance

The Supplier shall provide:

• Security assessments.

• Risk management support.

• Audit support.

• KPI development.

• Board reporting support.

• Security governance support.

• Independent design and control assurance.

• Security exception and risk acceptance reviews.

• Third party and supplier security assessments.